Method and device for controlling a vehicle drive unit

ABSTRACT

A method and an arrangement for controlling a drive unit of a vehicle are suggested. In this method, the control functions for the power of the drive unit and the monitoring of these control functions are carried out by a single microcomputer. A monitoring module, which is separate from the microcomputer, is provided for checking the monitoring functions. The monitoring module transmits test signals to the microcomputer at a given time. The microcomputer then computes the monitoring function on the basis of test data. The result of the computation is transmitted to the monitoring module which checks the operability of the monitoring function in the microcomputer by making a comparison to stored values.

FIELD OF THE INVENTION

The invention relates to a method and an arrangement for controlling adrive unit of a vehicle.

BACKGROUND OF THE INVENTION

A method and an arrangement of this kind are disclosed in U.S. patentapplication Ser. No. 08/836,018, filed Apr. 29, 1997, now U.S. Pat. No.5,880,568. There, a control unit is provided which includes amicrocomputer. The microcomputer carries out the control of the power ofthe drive unit (in the case of an internal combustion engine, via airsupply, fuel metering and/or ignition angle) as well as the monitoringof the correct function of these control programs. The program structureof this microcomputer includes essentially three mutually separatedlevels (compare also the description with respect to FIG. 1). In a firstlevel, the control functions are computed. In a second level, thecorrect operation of the control functions of the first level is checkedbased on selected input and output signals. In a third level, a check ofthe monitoring carried out in the second level is realized in thecontext of a sequence control. This sequence control checks the correctprocessing of the monitoring steps in cooperative relationship with amonitoring module (watchdog or safety computer). For this purpose, themonitoring module poses a question, which is selected from predeterminedquestions. This question is answered by the second level by forming apart answer of the programs. The second level sends the question back tothe monitoring module for detecting faults. In the preferred embodiment,the second level monitors the air adjustment of the engine and, in thecase of a fault, switches this air adjustment off or initiates anemergency operation. In this embodiment, the monitoring moduleintervenes in the output stage for the actuator, which controls the airsupply, as well as in the output stages for the metering of fuel and inthe ignition. Measures for monitoring the computations, which arecarried out in the context of the function monitoring in the secondlevel, in addition to the control of the program sequence are notdescribed in this known solution.

It is an object of the invention to provide measures for checking thecomputations in the context of the function monitoring.

SUMMARY OF THE INVENTION

The solution according to the invention permits the detection of faultsof the microcomputer which operates in the same manner on thecomputation of the control functions as well as on the computation ofthe monitoring functions. For this reason, and in an advantageousmanner, also quiescent faults are detected, for example, a monitoringfunction which does not compute correctly quantitatively.

Here, it is especially advantageous that operations are not used in thecontext of the solution of the invention which would be presentseparately from the programs to be monitored; instead, the program codesto be monitored are used. In this way, the solution according to theinvention permits an almost one-hundred percent check of the functionmonitoring of a control for a drive unit.

It is especially advantageous that representative tests can be carriedout for a suitable selection of sets of test data in all relevant valueranges. In this way, a bit-precise check of a monitoring function of apower control of a drive unit is provided.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be explained in greater detail with respect to theembodiments shown in the drawing. Here,

FIG. 1 shows a structural diagram of a control arrangement for a driveunit; whereas, in

FIGS. 2 and 3, a first embodiment of the solution of the invention isshown with reference to flowcharts.

FIGS. 4a-4e shows signal traces for this embodiment.

In FIGS. 5, 6 and 7, a second embodiment of the solution according tothe invention is shown as a block circuit diagram or as flowcharts.

DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION

In FIG. 1, a control unit 10 is shown for the control of a drive unit(preferably an internal combustion engine) of a motor vehicle. Thecontrol unit 10 includes, inter alia, an input circuit 12 to which inputlines 14 and 16 are connected from measuring devices 18 and 20. In theinput circuit 12, the input signals of the control unit are processedand supplied to a microcomputer 22. In the preferred embodiment of apower control, the measuring devices 18 and 20 are two measuring devicesfor detecting the degree of actuation of an operator-controlled elementactuated by the driver, for example, an accelerator pedal. The twomeasuring devices can be configured so as to be redundant or, in anotherembodiment, as a continuous measuring device (for example, apotentiometer) and a discontinuous measuring device (for example, aswitch). The measuring signals of the measuring devices are supplied viathe lines 14 and 16 to the input circuit 12 and are there processedseparately from each other and, preferably, are supplied to themicrocomputer 22 via separate paths 24 and 26, for example, via twoinput ports or two A/D-channels. In addition to these measuring signals,additional measurement variables of the drive unit and/or the vehicleare supplied to the control unit or to the microcomputer. Thesemeasurement variables are, for example, engine rpm, position of thepower adjusting element, et cetera which is not shown in FIG. 1 forreasons of clarity. The microcomputer 22 is, with respect to its programstructure, essentially subdivided into three levels. In a first level28, the programs 30 for carrying out the control of the drive unit arecombined. In the preferred embodiment, the programs are those whichadjust the torque of the drive unit on the basis of the degree ofactuation of the operator-controlled element (supplied via lines 44 and46) and additional operating variables. In the preferred embodiment ofan internal combustion engine, the air supply via an electricallyactuable throttle flap is adjusted and the fuel metering and theignition time point are computed. Correspondingly, the computer 22 hasoutput lines 32 and 34 which lead to output stages 36 and 38 which, inturn, adjust, via corresponding output lines 40 and 42, the ignitiontime point, fuel metering and air supply. In a second level 48, theprograms 50 are combined which serve to monitor functions of the controlfunctions 30. Here, in a preferred embodiment, a permissible torque ofthe drive unit which is derived from the driver command is compared tothe adjusted torque and, when this torque is exceeded, a fault conditionis detected. In the preferred embodiment of the control of an internalcombustion engine, plausibility checks of the degree of actuation of theoperator-controlled element can be carried out and of the adjustment ofthe throttle flap or corresponding values for the engine load.Accordingly, and on the one hand, the input signals with respect to thedegree of actuation of the operator-controlled element are supplied tolevel 2 (there the programs 50 for function monitoring) (connectinglines 52 and 54) and, on the other hand, computation results of programs30 for the control functions (connections 56 and 58) are supplied tolevel 2. In another embodiment, additionally, or alternatively to thecomputation results, measurement variables for the engine load, thethrottle flap position and/or the torque are supplied. The functionmonitoring 50 in a preferred embodiment exercises influence on theoutput stage 38 for controlling the throttle flap via the output line 60of the microcomputer 22. In addition to the first and second levels, theprogram structure of the microcomputer 22 has a third level 62 in whichthe programs 64 for the sequence control of the function monitoring 50are combined. The programs 64 then communicate via connecting lines 66and 68 to a monitoring module 70 of a watchdog or safety computer 72which is separate from the microcomputer. For sequence control, themonitoring module 70 selects predetermined sequences in the programs 64via the connecting line 66. These sequences comprise essentially thatthe sequence control 64 triggers in the function monitoring 50 theexecution of a computation (response) on the basis of componentresponses which are formed in accordance with selected program steps(via line 74). The result of this computation is again supplied to thesequence control 64 (via connection 76). The result or a variablederived therefrom is supplied by the sequence control 64 via theconnection 68 to the monitoring module 70 which compares the response toits question outputted via line 66. In the case of a fault, themonitoring module 70 exercises influence via the output line 68 on theoutput stages 36 and 38.

In the preferred embodiment, a desired value for the torque of the driveunit is derived from the degree of actuation of the operator-controlledelement. The actual torque is caused to approach this desired value byadjusting the air supply, the fuel metering and the ignition angle.

According to the invention, and for expanded monitoring of the functionof the microcomputer, and at least in the critical case of the releasedoperator-controlled element (idle), the following is provided in a firstembodiment: the monitoring module 70 outputs cyclically (for example,every 200 msec) at least in predetermined operating states a stimulusinformation via the serial interface or a port pin to the microcomputer22 when, for example, the operator-controlled element is released, whenmaintained at steady state, the degree of actuation is within a pregivenvalue range and/or after the elapse of a predetermined operatingduration or number of operating cycles. The microcomputer 22 reacts tothis stimulus signal in that it, at least for parts of the monitoringfunction (preferably for the actual torque computation or for thecomputation of the permissible torque) does not take the variables,which are stored in the memory cell, as a basis for the monitoringfunction but rather test signals which hurt the monitoring function inthe corresponding operating state (for example, which cause a highactual torque or a low permissible torque). These variables are, forexample, actual torque forming variables such as the load signal andadjusted ignition angle or the degree of actuation. When the programs ofthe level 2 operate correctly, a fault must be detected in this case.The fault counter, which is available in the level 2, is accordinglyincremented. For a certain count of the fault counter, the monitoringmodule expects a specific reaction of the microcomputer 22, for example,the transmission of a fault signal or a reset signal. If the monitoringmodule 70 receives a signal of this kind, then the stimulus signal iswithdrawn and a functionally operable second level is recognized. If thecorresponding signal is not recognized within a pregiven time span(increment time of the counter), then either one of the programs oflevel 2 has a fault or a function is active in which the driver does notactuate the pedal (for example, road-speed controller, drag torquecontroller) and this function increases the engine torque beyond thecommand of the driver (at least then when the actual torque isinfluenced by the test signal). To check this, the monitoring module 70maintains the stimulus signal. In the context of its functionmonitoring, the microcomputer 22 now computes the torque monitoring onthe basis of the driver command (idle) and not as for the increasedintervention provided with other permissible torques. In this case, thefault counter must in any event be incremented so that the correspondingreaction signal of the microcomputer 22 is triggered. If such a signalis not received by the monitoring module 70, then a fault is detected inthe area of function monitoring and the corresponding switch-off oremergency measures are initiated via the output line 78.

A first embodiment of the solution of the invention is shown in FIGS. 2and 3 with respect to flowcharts. These sketch the realization of thesolution as programs in the monitoring module and in the functionmonitoring.

The flowchart shown in FIG. 2 defines a program of the monitoring module70. This program is carried out in pregiven time intervals (for example,every 200 msec) when one of the above-mentioned operating states ispresent. In the first step 100, the stimulus signal is outputted to themicrocomputer 22 (FR=function computer). The stimulus signal is then,for example, realized with a level change, via a signal having apregiven pulse-duty factor or a pregiven voltage magnitude on an inputline of the microcomputer 22. In the next step 102, a check is made asto whether, after a lapse of a predetermined time span, during which thefault counter has reliably reached its maximum value, the correspondingreaction signal from the microcomputer 22 has been detected. If this isthe case, then, according to step 104, the test is viewed as beingcompleted and the subprogram is ended. The subprogram is again initiatedwith the presence of the next pregiven operating situation.

In another advantageous embodiment, and in lieu of the reaction signalof the microcomputer 22, the actual fault counter position istransmitted to the monitoring module 70. The monitoring module 70detects the correct function or a faulty operation of the microcomputer22 based on the time-dependent trace of the fault counter or when alimit value is exceeded.

If the monitoring module does not detect the operation of themicrocomputer to be expected based on the stimulus signal in step 102,then, in accordance with step 106, the output of the stimulus signal ismaintained. Thereupon, in accordance with step 108, a check is madeagain as to whether the reaction from the microcomputer 22 or theexpected performance of the fault counter of the microcomputer 22 ispresent. If this is the case, then, in accordance with step 110, thetest is viewed as completed and the program is ended; whereas, in theopposite case, and in accordance with step 112, it is assumed that afault is present in the area of the function monitoring of themicrocomputer 22 and corresponding fault reactions are initiated by themonitoring module. These include essentially a switchoff of the outputstages for metering fuel, the ignition angle and the air supply or, anemergency operation, which has as a consequence a limited (especially apower limited) control of the drive unit. The program is ended afterstep 112.

In FIG. 3, the corresponding program of level 2 (the function monitoringof the microcomputer 22) is shown. This is initiated in pregiven timeintervals (for example, every several milliseconds). After start of thesubprogram, and in a first step 200, the degree of actuation of theoperator-controlled element β as well as the engine rpm N_(mot) are readin and, in accordance with step 202, a permissible torque MIZUL isdetermined on the basis of a pregiven characteristic field, a pregiventable or pregiven computation steps from the degree of actuation β andthe engine rpm N_(mot). This permissible torque is then dimensioned insuch a manner that it is not exceeded by the actual torque of the driveunit during fault-free operation of the microcomputer while consideringall tolerances. Thereafter, in step 204, a check is made whether astimulus signal from the monitoring module is present. If this is notthe case, then function monitoring is initiated with steps 206 and 208.For this purpose, the load signal TL (for example, formed from air massand engine rpm) and the adjusted ignition angle ZW are read in (step206) and, on the basis of these two variables, as well as the engine rpmand in accordance with a predetermined characteristic field, apredetermined table or predetermined computation steps, the torqueMI_(act) outputted by the engine is determined. In the next inquiry step210, a check is made as to whether just then an intervention is active,for example, via a road-speed controller (FGR) or an engine drag torquecontroller (MSR) with this intervention being an intervention increasingtorque compared to the desired torque pregiven by the operator. If thisis the case, then, and according to step 212, the permissible torqueMIZUL is set to a maximum value MI_(max) which, for example, isdependent upon rpm or dependent upon speed. The maximum value MI_(max)is predetermined for these operating states. After step 212, acomparison is made between the actual torque MI_(act) and permissibletorque MIZUL. This is the same as in the case after a "no" answer instep 210. If the computed actual torque is greater than the computedpermissible torque, then, according to step 216, the fault counter F isincremented; in the opposite case, according to step 218, the faultcounter F is decremented. In the next inquiry step 220, a check is madeas to whether the fault counter has reached its maximum value. If thisis the case, then, according to step 222, a corresponding signal isoutputted to the monitoring module 70 (safety computer SR) and theprogram is ended in step 220 as in the case of a "no" answer.

If, in step 204, it results that a stimulus signal is present, then acounter i is incremented in accordance with step 224. The counter i runsin this part of the program. Thereupon, in step 226, selected testsignals are pregiven for the engine load TLT and the ignition angle ZWTand, according to step 228 (corresponding to step 208), an actual torqueis specified. In the next inquiry step 230, the counter i is compared toa maximum value i_(max). If this maximum value is not reached, then theprogram continues with step 210; otherwise, a jump is made directly intostep 214. The counter i then assures that, for a stimulus signal whichcontinues to be present and an active road-speed controller or an activedrag torque controller, the desired test situation is generated. Themaximum value i_(max) is then dimensioned with a view to the time spanwhich the fault counter requires in order to reach its maximum value(for example, two to three program runthroughs). If the actual torqueexceeds the permissible torque and the fault counter runs up properly,then, according to step 222, the reaction signal is outputted to themonitoring module for a correct operating monitoring function.

In another advantageous embodiment, the count of the fault counter istransmitted at least for a test situation.

In FIG. 4, the solution of the invention is shown with respect to timediagrams. FIG. 4a shows the time-dependent trace of the stimulus signaland FIG. 4b shows the time-dependent traces of the actual torque and thepermissible torque. FIG. 4c shows the time-dependent trace of the faultcounter and FIG. 4d shows the intervention of a road-speed controller ordrag torque controller. FIG. 4e shows the time-dependent trace of thefeedback signal of the microcomputer 22 to the monitoring module 70.

At a first time point T0, the microcomputer 22 receives the stimulussignal outputted by the monitoring module (see FIG. 4a). The actualtorque (FIG. 4b, solid line) is then determined in accordance with testdata and, directly thereafter, exceeds the permissible torque which iscomputed on the basis of the degree of actuation (FIG. 4b, broken line).Correspondingly, the fault counter increments up until, at time pointT1, the maximum fault count F_(max) is reached (see FIG. 4c). This leadsin correspondence to FIG. 4e to the output of a corresponding faultsignal to the monitoring module, to a resetting of the stimulus signaland to an end of the test situation (see FIGS. 4a, 4b). In this example,the monitoring operated correctly. The fault counter is againdecremented after the time point T1.

A road-speed controller is activated at a later time point T2 (FIG. 4d).In this operating situation, the permissible torque is increased (seeFIG. 4b). At time point T3, the monitoring module outputs a stimulussignal to the microcomputer 22. This signal leads, in correspondence toFIG. 4b, to the computation of the actual torque in accordance with testdata. In this case, the actual torque, in accordance with test data,does not exceed the permissible torque. This means that, at time pointT4, the stimulus signal is maintained and the permissible torque is sodetermined as if the road-speed controller were not engaged. For thisreason, and for a functioning monitoring, the actual torque exceeds thepermissible torque (see FIG. 4b) as in the previous situation so that,starting at time point T4 until time point T5, the fault counter isincremented. Reaching the maximum count of the fault counter leads, attime point T5, to the output of the fault signal to the monitoringmodule so that, here too, the correct operation of the monitoring isshown. Starting at time point T5, the fault counter is again decrementedin accordance with FIG. 4c.

A second embodiment of the solution of the invention is shown withrespect to FIGS. 5 to 7. This embodiment too serves to check whether themonitoring tasks of a microcomputer are executed properly and reliablyand is utilized especially for control systems wherein the controlfunctions and the monitoring functions are implemented by the samemicrocomputer. With the transfer of the fault counter or of a signalderived therefrom in accordance with the first embodiment, a directcheck of the monitoring function is obtained although a precise bitcheck of the monitoring function does not take place. Instead, a type ofthreshold monitoring is carried out. To provide a precise bit check ofthe computations in the context of the monitoring of level 2, themonitoring function of level 2 is therefore, in accordance with thesecond embodiment, at least in predetermined operating situations,alternately computed with real data and with test data. Preferably, forthe computation with test data, the original program of level 2 is usedwith changed data. A copy of the program is used in another advantageousembodiment.

For the computation of the monitoring with real data, a permissibleengine torque is determined from the actual values of pedal position andengine rpm and an actual torque is determined from the values for theair charge, rpm and ignition angle. An incorrectness with respect toplausibility is checked via a difference formation. In a case of anincorrectness, preferably in the case of an actual torque, which is toogreat in comparison to the permissible engine torque, a fault counter isstarted. After this computation, the monitoring module outputs a testsignal whereupon this computation is not made with real data but withtest data (for engine rpm, pedal position, air charge and ignitionangle). These test data are either stored in the monitoring module andare transmitted via an interface to the microcomputer 22 or are storedin the microcomputer 22 as different sets of test data which themonitoring module selects via a transmitted index. For a fixed set oftest data, there is only a single correct solution for the differencebetween permissible torque and actual torque. This correct solution,which belongs to each set of test data, is known to the monitoringmodule. The microcomputer 22 transmits this difference to the monitoringmodule which checks the correctness of the result. The sets of test dataare so selected that plausible results as well as implausible resultsare determined. For this reason, a check can also be made as to whetherthe monitoring level is still in the position to differentiate plausiblestates from implausible states.

This second embodiment is shown as a block circuit diagram in FIG. 5.This block diagram symbolizes the program structure in level 2 of themicrocomputer 22. The engine rpm N_(mot), the accelerator pedal positionβ, the air charge TL and the adjusted ignition angle ZW are supplied tothe monitoring function via the respective connections 300, 302, 304 and306. These signals are transmitted further via respective switchingelements 308, 310, 312 and 314. The engine rpm is conducted to thefollowing: a first characteristic field 316 to determine the permissibleengine torque; to a second characteristic field 318 to determine theoptimal engine torque; and, to a characteristic field 320 to determinethe optimal ignition angle. The pedal position β is conducted via afilter 322 to the first characteristic field 316. The air charge isconducted to the second characteristic field 318 and to the thirdcharacteristic field 320. The optimal ignition angle is determined inthe characteristic field 320 (highest efficiency for the internalcombustion engine). This ignition angle is conducted to an additionstage 321 wherein the difference between the optimal ignition angle andthe actual ignition angle is formed. This difference is conducted via acharacteristic line 324 to a multiplier position 326. The characteristicline 324 converts the deviation of the ignition angle into a deviationof the actual torque from the optimal torque (highest efficiency). Inthe multiplier position 326, the optimal engine torque is corrected viaan ignition angle deviation in accordance with the torque correction.The result is a measure for the actual torque. This actual torque isconducted to the adding position 328 to which the permissible torque isalso conducted from characteristic field 316. By subtracting thepermissible torque from the actual torque, the torque difference isformed which is conducted via the connecting line 330 to the monitoringmodule. Furthermore, the torque difference is conducted to a thresholdvalue switch 337 which increments the fault counter 334 in the eventthat the actual torque exceeds the permissible torque. In the preferredembodiment, the count of the fault counter is transmitted to themonitoring module via connection 336 at least when the fault counterreaches its maximum value. A connection 338 is provided from themonitoring module which switches the switching elements 308 to 314 fromthe normal position into the test position shown in phantom outline. Inthis position, the connections for engine rpm, pedal position, aircharge and ignition angle are connected with tables or memories 340,342, 344 and 346 which contain different sets of test data. These setsof test data are selected in dependence upon the selection signalsupplied from the monitoring module via connection 348.

Examples for realizing the solution of the invention are presented inthe context of the second embodiment as computer programs and are shownas flowcharts in FIGS. 6 and 7. FIG. 6 shows the program which is runthrough in the monitoring module; whereas, FIG. 7 describes a programwhich is run through in the microcomputer 22.

The program of the monitoring module shown in FIG. 6 is called up atpregiven time intervals. In an advantageous embodiment, the subprogramis called up only in at least one of the above-mentioned specificoperating situations. In the first step 400 of the subprogram shown, thetest signal is formed and outputted to the microcomputer 22 and a set oftest data or an index fixing a set of test data is transmitted. The testdata are read out in the preferred embodiment with respect to the actualoperating state (defined by accelerator pedal position and engine rpm orair charge) and are alternately selected as plausible combination orimplausible combination. In the context of the realization of thesolution of the invention, also other strategies are utilized (forexample, only plausible data, only implausible data) with respect tostarting the test and the selection and input of the test data. In thenext step 402, the torque difference MI_(Diff), which is computed by themicrocomputer 22, as well as the count of the fault counter, ifrequired, are read in and, in step 404, a check is made on the basis ofstored difference values as to whether the computed result is correct.If the result is correct, the program is started anew with other testdata. If the result does not match, then, in accordance with step 406, afault state is detected and the subprogram is ended. Depending upon theselected strategy, the corresponding reactions (switchoff of the outputstages) can be carried out after a one-time detection of a fault or onlyfor a multiple detection of faults. In other advantageous embodiments, afault counter runs in the monitoring module and, when the maximum valueof the fault counter is reached, fault measures are initiated. When thecount of the fault counter is transmitted, the monitoring module checksthe time-dependent trace of the count of the fault counter and/or if themaximum value is reached.

The subprogram shown in FIG. 7 shows a program which is started in themicrocomputer 22 at pregiven time intervals. After the start of theprogram, and in a first step 500, the test variables for the pedalposition, the engine rpm, the ignition angle and the air charge areselected and read in when a test signal is present. If no test signal ispresent, then the measured or computed actual variables are read in. Inthe following, a situation is described wherein a test signal ispresent. In normal operation, the program is run through correspondinglyexcept that in lieu of the test data, the actual values of the operatingvariables are used. In step 502, the signal value for the pedal positionis subjected to a pregiven filtering. Thereupon, and in accordance withstep 504, the permissible torque MIZUL is determined on the basis of thetest values for pedal position and engine rpm and the actual torqueMI_(act) is determined on the basis of test quantities for the aircharge, ignition angle and engine rpm. In the next step 506, thedifference torque MI_(Diff) is formed as the difference of the actualtorque and of the permissible torque and, in accordance with step 508,this difference torque MI_(Diff) is outputted to the monitoring module.In the next step 510, a check is made as to whether the differencetorque is greater than 0. If this is the case, then the fault counter512 is incremented by 1; otherwise, the fault counter 512 is decremented(step 514). Thereupon, and in step 516, a check is made as to whetherthe fault counter has reached its maximum value. For a positive answer,and in accordance with step 518, a fault is detected and, if required, acorresponding signal is outputted to the monitoring module. If the faultcounter has not yet reached its maximum value, the program is ended andrestarted at a pregiven time. Alternatively, the actual count of thefault counter is transmitted.

A combination of the first and second embodiments is especiallyadvantageous. Here, the difference between the torque quantities as wellas the fault counter are transmitted from the microcomputer 22 to themonitoring module. The monitoring module monitors on the basis of thesevalues the bit-precise computation of the torque difference as well asthe operation of the fault determination (especially the differentiationbetween plausible and implausible deviations of the permissible torquefrom the computed torque).

The control function for the torque adjustment runs, notwithstanding thetest phases for the function monitoring, always on the basis of theactual values so that the operation of the drive unit is not affected bythe test.

The solution of the invention is utilized in the same manner also fordiesel engines while considering the corresponding operating variables.

The monitoring function is described in the preferred embodiment on thebasis of the indicated torque, that is, on the basis of the torquegenerated by combustion. In other embodiments, the monitoring andtherefore also the test is performed on the basis of another torquevalue (for example, the outputted torque), a charge value or load value,a power value or pedal position and throttle flap position. The solutionof the invention is carried out in a corresponding manner with the inputof the sets of test data.

In addition to the computation of the permissible torque on the basis ofthe accelerator pedal position, the adjustment of otheroperator-controlled elements is also taken into consideration incorresponding operating states (for example, a road-speed controller),desired values of external interventions which input a desired torquevalue (for example, road-speed controller, engine drag torquecontroller, drive slip controller, et cetera) and/or special operatingvariables (for example, road speed, slip, rpm, et cetera) in theseoperating states for the determination of permissible torque and, inthis way, the monitoring and their check is ensured even in this or inother operating states.

If the solution of the invention is utilized for diesel engines, then,in lieu of the charge, fuel quantity and in lieu of the ignition, theinjection start is read.

In addition to transmitting the difference between permissible andactual torque and/or the count of the fault counter, other intermediatequantities are transmitted in other embodiments, such as the permissibletorque and the actual torque, an evaluated difference when exceedingthreshold values, et cetera.

We claim:
 1. A method for controlling a drive unit of a vehicle, themethod comprising the steps of:providing a microcomputer for controllingthe power of the drive unit via first programs in dependence uponoperating variables of the drive unit and of the vehicle and formonitoring this power control via second programs on the basis ofselected operating variables in accordance with a monitoring function;providing a monitoring module for issuing a test signal to permit saidmicrocomputer to monitor the operability of said monitoring function;utilizing said microcomputer to compute said monitoring function inaccordance with said test signal on the basis of selected test data withsaid microcomputer determining at least one result of said monitoringfunction; and, transmitting said at least one result to said monitoringmodule for checking the accuracy thereof.
 2. The method of claim 1,wherein the monitoring module checks the operability of the monitoringfunction in the microcomputer by comparing the transmitted result to anexpected value.
 3. The method of claim 2, wherein the monitoringfunction is executed on the basis of a permissible torque and a computedactual torque, the permissible torque being computed in dependence uponthe position of operator-controlled elements or external inputs.
 4. Themethod of claim 3, wherein the drive unit is an internal combustionengine which receives an air charge and has an ignition angle which canbe adjusted; and, the permissible torque is computed on the basis ofengine rpm, accelerator pedal position and the adjustment of otheroperator-controlled elements or external inputs; and, the actual torqueis computed on the basis of the air charge at least one of thefollowing: fuel quantity, the engine rpm and the adjusted ignition angleand injection start.
 5. The method of claim 4, wherein: in order tocheck the monitoring function, a permissible torque and an actual torqueare determined on the basis of test data and compared to each other. 6.The method of claim 5, wherein: to check the monitoring function inresponse to a test signal, an actual torque is determined on the basisof test signals and is compared to the permissible torque determined onthe basis of measured values.
 7. The method of claim 6, wherein thedifference between actual torque and permissible torque is transmittedto the monitoring module which checks the correctness of the computationof the difference in the microcomputer on the basis of stored measuredquantities assigned to the test data.
 8. The method of claim 7, wherein:when the actual torque exceeds the permissible torque, a fault counteris incremented and the count of this counter or the count thereof inexcess of a maximum count of the counter is outputted to the monitoringmodule, which determines the operability of the monitoring on the basisof the transmitted signal.
 9. The method of claim 8, wherein: for anintervention which can increase the torque beyond the driver command,the maximum permissible torque is set to a higher value independent ofthe driver command; the monitoring module, for a non-detected reactionof the microcomputer to incorrect test data, causes the microcomputer toapply the permissible torque, which is derived from the pedal, even inthis operating state for checking the monitoring.
 10. The method ofclaim 9, wherein: said drive unit is provided with an output stage foradjusting the air supplied to said drive unit and is provided with anoutput stage for metering fuel thereto; and, wherein for a case of afault detected by the monitoring function, the output stages for theadjustment of air and/or the output stages for the metering of fuel aredisabled by the monitoring module.
 11. An arrangement for controlling adrive unit of a vehicle, the arrangement comprising:a microcomputer forcontrolling the power of the drive unit via first programs in dependenceupon operating variables of the drive unit and of the vehicle andmonitoring execution of said first programs via second programs on thebasis of selected operating variables; a monitoring module for issuing atest signal to permit said microcomputer to monitor the operability ofsaid monitoring function; said microcomputer being programmed to computesaid monitoring function in accordance with said test signal on thebasis of selected test data with said microcomputer determining at leastone result of said monitoring function; and, means for transmitting saidat least one result to said monitoring module for checking the accuracythereof.